How can i make my token to persist after creating a new user?

I am developing an api with expressjs and mongodb.

The user can login. Only if the logged in user is an admin, then the user can access /register to register new users.

So i want that the only person able to create new employees and their respective user is the admin user, from inside the app.

I have the following methods in my controller auth.js:

exports.register = asyncHandler(async (req, res, next) => {
        const { email, password, name, lastName } = req.body;
        const user = await User.create({
            email,
            password
        });

        const employee = await Employee.create({
            name,
            lastName,
            user: user._id
        })

        res.status(200).json({
          success: true,
          user: user,
          employee: employee
        })
    
});

// @desc   Loginuser
// @route  POST /api/v1/auth/login
// @access Public

exports.login = asyncHandler(async (req, res, next) => {
    const { email, password } = req.body;
  
    // Validate emil & password
    if (!email || !password) {
      return next(new ErrorResponse('Please provide an email and password', 400));
    }
  
    // Check for user
    const user = await User.findOne({ email }).select('+password');
  
    if (!user) {
      return next(new ErrorResponse('Invalid credentials', 401));
    }
  
    // Check if password matches
    const isMatch = await user.matchPassword(password);
  
    if (!isMatch) {
      return next(new ErrorResponse('Invalid credentials', 401));
    }

    sendTokenResponse(user, 200, res);

  });

// Get token from model, create cookie and send response
const sendTokenResponse = (user, statusCode, res) => {
    // Create token
    const token = user.getSignedJwtToken();
  
    const options = {
      expires: new Date(
        Date.now() + process.env.JWT_COOKIE_EXPIRE * 24 * 60 * 60 * 1000
      ),
      httpOnly: true
    };
  
    if (process.env.NODE_ENV === 'production') {
      options.secure = true;
    }
  
    res
      .status(statusCode)
      .cookie('token', token, options)
      .json({
        success: true,
        token
      });
  };

  // @desc   Get current logged in user
  // @route  POST /api/auth/me
  // @access Private

  exports.getMe = asyncHandler(async (req, res, next) => {
    const user = await User.findById(req.user._id);
  
    res.status(200).json({
      success: true,
      data: user
    });
  
  })

And i have the following middleware functions:

const jwt = require('jsonwebtoken');
const asyncHandler = require('./async');
const ErrorResponse = require('../utils/errorResponse');
const User = require('../models/User');

// Protect Routes 
exports.protect = asyncHandler(async (req, res, next) => {
    let token;
  
    if (req.headers.authorization && req.headers.authorization.startsWith('Bearer')) {
      token = req.headers.authorization.split(' ')[1];
    } /* else if (req.cookies.token) {
        token = req.cookies.token;
    } */
  
    // Make sure token exists
    if (!token) {
      return next(new ErrorResponse('Not authorized to access this route', 401));
    }
  
    try {
      // Verify token
      const decoded = jwt.verify(token, process.env.JWT_SECRET);
  
      // Check if decoded has id property
      if (!decoded.id) {
        return next(new ErrorResponse('Invalid token', 401));
      }
  
      req.user = await User.findById(decoded.id);
      if (!req.user) {
        return next(new ErrorResponse('User not found', 404));
      }
  
      next();
    } catch (error) {
      return next(new ErrorResponse('Invalid token', 401));
    }
  });
  


//Grant access to specific roles
exports.authorize = (...roles) => {
    return (req, res, next) => {
        if(!roles.includes(req.user.role)) {
            return next(new ErrorResponse(`User role ${req.user.role} is not authorized to access this route`, 403));
        }
        next();
    }
}

The log in works fine and i can get the current logged in user. And if the logged in user is not an admin i get the corresponding error message. If the user is an admin i am being able to create a new user. The issue is that after creating a new user, the token of the already logged in user is deleted, it is not persisting. And if i go again to the endpoint api/auth/me i get the error message of Invalid token.

How can i make my token to persist? Because maybe with the admin user i want to create more than one user without being logged out.

Of course the token is deleted because you don't resend the token in the response of register function.

If you add sendTokenResponse(req.user, 200, res); to register section, you'll create a new token.

You can use existing token in below code. For your case your code should be like,

exports.register = asyncHandler(async (req, res, next) => {
        /* 
         * Check the session
         * If there is a session and logged in user is an admin
         * OR
         * If you already have access the token, skip this  
         * section and resend the token in response
         */
        const { token } = req.cookies;
        
        .
        .
        .

        // There should be two different responses here too
        // This is for logged in user as an admin
        res
         .status(200)
         .cookie('token', token, options)
         .json({
          success: true,
          user: user,
          employee: employee
        })

        // This is for non-session cases
        res.status(200).json({
          success: true,
          user: user,
          employee: employee
        })
    
});

I told you how to do it, I hope you can code it :).

NOTE: I think instead of complicating the function that much, you should write a new function called addUser and give access to only admin and ofc you should resend the token in response.